# CVEs published 2020-06-03

127 CVEs were published on June 3, 2020: 3 critical, 20 high. Days are UTC.

- [CVE-2020-7030](https://cve.now/CVE-2020-7030.md): IPO Information Disclosure (CVSS 5.5, Avaya IP Office)
- [CVE-2020-11094](https://cve.now/CVE-2020-11094.md): Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar (CVSS 6.1, rainlab debugbar-plugin · rainlab/debugbar-plugin)
- [CVE-2020-11091](https://cve.now/CVE-2020-11091.md): Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements (CVSS 5.8, weaveworks Weave · github.com/weaveworks/weave)
- [CVE-2020-6504](https://cve.now/CVE-2020-6504.md): Insufficient policy enforcement in notifications in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass notification re (no CVSS, Google Chrome)
- [CVE-2020-6502](https://cve.now/CVE-2020-6502.md): Incorrect implementation in permissions in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted (no CVSS, Google Chrome)
- [CVE-2020-6503](https://cve.now/CVE-2020-6503.md): Inappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensit (no CVSS, Google Chrome)
- [CVE-2020-6500](https://cve.now/CVE-2020-6500.md): Inappropriate implementation in interstitials in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the (no CVSS, Google Chrome)
- [CVE-2020-6501](https://cve.now/CVE-2020-6501.md): Insufficient policy enforcement in CSP in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy vi (no CVSS, Google Chrome)
- [CVE-2020-6497](https://cve.now/CVE-2020-6497.md): Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofin (no CVSS, Google Chrome)
- [CVE-2020-6498](https://cve.now/CVE-2020-6498.md): Incorrect implementation in user interface in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofin (no CVSS, Google Chrome)
- [CVE-2020-6499](https://cve.now/CVE-2020-6499.md): Inappropriate implementation in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass AppCache security restri (no CVSS, Google Chrome)
- [CVE-2020-6495](https://cve.now/CVE-2020-6495.md): Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.97 allowed an attacker who convinced a user to instal (no CVSS, Google Chrome)
- [CVE-2020-6496](https://cve.now/CVE-2020-6496.md): Use after free in payments in Google Chrome on MacOS prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape (no CVSS, Google Chrome)
- [CVE-2020-6493](https://cve.now/CVE-2020-6493.md): Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker who had compromised the renderer proces (no CVSS, Google Chrome)
- [CVE-2020-6494](https://cve.now/CVE-2020-6494.md): Incorrect security UI in payments in Google Chrome on Android prior to 83.0.4103.97 allowed a remote attacker to spoof the contents of the O (no CVSS, Google Chrome)
- [CVE-2020-6419](https://cve.now/CVE-2020-6419.md): Out of bounds write in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2020-6453](https://cve.now/CVE-2020-6453.md): Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2011-1805](https://cve.now/CVE-2011-1805.md): Bad cast in CSS in Google Chrome prior to 11.0.0.0 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (no CVSS, Google Chrome)
- [CVE-2011-2863](https://cve.now/CVE-2011-2863.md): Insufficient policy enforcement in V8 in Google Chrome prior to 14.0.0.0 allowed a remote attacker to obtain potentially sensitive informati (no CVSS, Google Chrome)
- [CVE-2020-5299](https://cve.now/CVE-2020-5299.md): Potential CSV Injection vector in OctoberCMS (CVSS 4.0, octobercms october · october/backend)
- [CVE-2020-5296](https://cve.now/CVE-2020-5296.md): Arbitrary File Deletion vulnerability in OctoberCMS (CVSS 6.2, octobercms october · october/cms)
- [CVE-2020-5297](https://cve.now/CVE-2020-5297.md): Upload whitelisted files to any directory in OctoberCMS (CVSS 3.4, octobercms october · october/cms)
- [CVE-2020-5298](https://cve.now/CVE-2020-5298.md): Reflected XSS when importing CSV in OctoberCMS (CVSS 4.0, octobercms october · october/backend)
- [CVE-2020-5295](https://cve.now/CVE-2020-5295.md): Local File read vulnerability in OctoberCMS (CVSS 4.8, octobercms october · october/cms)
- [CVE-2020-13795](https://cve.now/CVE-2020-13795.md): An issue was discovered in Navigate CMS through 2.8.7. (no CVSS)
- [CVE-2020-13796](https://cve.now/CVE-2020-13796.md): An issue was discovered in Navigate CMS through 2.8.7. (no CVSS)
- [CVE-2020-13797](https://cve.now/CVE-2020-13797.md): An issue was discovered in Navigate CMS through 2.8.7. (no CVSS)
- [CVE-2020-13798](https://cve.now/CVE-2020-13798.md): An issue was discovered in Navigate CMS through 2.8.7. (no CVSS)
- [CVE-2020-13792](https://cve.now/CVE-2020-13792.md): PlayTube 1.8 allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users directory traversal, aka local fi (no CVSS)
- [CVE-2020-13790](https://cve.now/CVE-2020-13790.md): libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get\_rgb\_row() in rdppm.c via a malformed PPM input file. (no CVSS)
- [CVE-2020-13379](https://cve.now/CVE-2020-13379.md): The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. (no CVSS, github.com/grafana/grafana)
- [CVE-2020-3353](https://cve.now/CVE-2020-3353.md): Cisco Identity Services Engine Denial of Service Vulnerability (CVSS 5.9, Cisco Identity Services Engine Software)
- [CVE-2020-3339](https://cve.now/CVE-2020-3339.md): Cisco Prime Infrastructure SQL Injection Vulnerability (CVSS 5.4, Cisco Prime Infrastructure)
- [CVE-2020-3335](https://cve.now/CVE-2020-3335.md): Cisco Application Services Engine Software Authorization Vulnerability (CVSS 5.5, Cisco Application Policy Infrastructure Controller)
- [CVE-2020-3333](https://cve.now/CVE-2020-3333.md): Cisco Application Services Engine Software Unauthenticated Event Policies Update Vulnerability (CVSS 5.3, Cisco Application Policy Infrastructure Controller)
- [CVE-2020-3281](https://cve.now/CVE-2020-3281.md): Cisco Digital Network Architecture Center Information Disclosure Vulnerability (CVSS 4.3, Cisco Digital Network Architecture Center)
- [CVE-2020-3267](https://cve.now/CVE-2020-3267.md): Cisco Unified Contact Center Express Improper API Authorization Vulnerability (CVSS 5.4, Cisco Unified Contact Center Express)
- [CVE-2020-3258](https://cve.now/CVE-2020-3258.md): Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution Vulnerabilities (CVSS 9.8, Cisco IOS 12.2(60)EZ16)
- [CVE-2020-3257](https://cve.now/CVE-2020-3257.md): Cisco IOx Application Environment for IOS Software for Cisco Industrial Routers Vulnerabilities (CVSS 8.1, Cisco IOS 12.2(60)EZ16)
- [CVE-2020-3238](https://cve.now/CVE-2020-3238.md): Cisco IOx Application Framework Arbitrary File Creation Vulnerability (CVSS 8.1, Cisco IOx)
- [CVE-2020-3237](https://cve.now/CVE-2020-3237.md): Cisco IOx Application Framework Arbitrary File Overwrite Vulnerability (CVSS 6.3, Cisco IOx)
- [CVE-2020-3235](https://cve.now/CVE-2020-3235.md): Cisco IOS and IOS XE Software Simple Network Management Protocol Denial of Service Vulnerability (CVSS 7.7, Cisco IOS 12.2(53)SG1)
- [CVE-2020-3234](https://cve.now/CVE-2020-3234.md): Cisco IOS Software for Cisco Industrial Routers Virtual Device Server Static Credentials Vulnerability (CVSS 8.8, Cisco IOS 12.2(60)EZ16)
- [CVE-2020-7013](https://cve.now/CVE-2020-7013.md): Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. (no CVSS, Elastic Kibana)
- [CVE-2020-7014](https://cve.now/CVE-2020-7014.md): The fix for CVE-2020-7009 was found to be incomplete. (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2020-7015](https://cve.now/CVE-2020-7015.md): Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. (no CVSS, Elastic Kibana)
- [CVE-2020-7011](https://cve.now/CVE-2020-7011.md): Elastic App Search versions before 7.7.0 contain a cross site scripting (XSS) flaw when displaying document URLs in the Reference UI. (no CVSS, Elastic App Search)
- [CVE-2020-7012](https://cve.now/CVE-2020-7012.md): Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. (no CVSS, Elastic Kibana)
- [CVE-2020-7010](https://cve.now/CVE-2020-7010.md): Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. (no CVSS, Elastic Cloud on Kubernetes · github.com/elastic/cloud-on-k…)
- [CVE-2020-3233](https://cve.now/CVE-2020-3233.md): Cisco IOx Application Framework Local Manager Stored Cross-Site Scripting Vulnerability (CVSS 6.4, Cisco IOx)
- [CVE-2020-3232](https://cve.now/CVE-2020-3232.md): Cisco ASR 920 Series Aggregation Services Router Model 12SZ-IM SNMP Denial of Service Vulnerability (CVSS 6.3, Cisco ASR 920 Series Aggregation Services Router)
- [CVE-2020-3200](https://cve.now/CVE-2020-3200.md): Cisco IOS and IOS XE Software Secure Shell Denial of Service Vulnerability (CVSS 7.7, Cisco IOS 12.2(58)SE)
- [CVE-2020-3199](https://cve.now/CVE-2020-3199.md): Cisco IOx Application Environment for IOS Software for Cisco Industrial Routers Vulnerabilities (CVSS 8.1, Cisco IOS 12.2(60)EZ16)
- [CVE-2020-3198](https://cve.now/CVE-2020-3198.md): Cisco IOS Software for Cisco Industrial Routers Arbitrary Code Execution Vulnerabilities (CVSS 9.8, Cisco IOS 12.2(60)EZ16)
- [CVE-2020-3228](https://cve.now/CVE-2020-3228.md): Cisco IOS, IOS XE, and NX-OS Software Security Group Tag Exchange Protocol Denial of Service Vulnerability (CVSS 6.8, Cisco IOS 15.3(2)T)
- [CVE-2020-3231](https://cve.now/CVE-2020-3231.md): Cisco IOS Software for Catalyst 2960-L Series Switches and Catalyst CDB-8P Switches 802.1X Authentication Bypass Vulnerability (CVSS 4.7, Cisco IOS 15.2(5a)E)
- [CVE-2020-3230](https://cve.now/CVE-2020-3230.md): Cisco IOS and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerability (CVSS 7.5, Cisco IOS 15.1(2)T)
- [CVE-2020-3229](https://cve.now/CVE-2020-3229.md): Cisco IOS XE Software Web UI Privilege Escalation Vulnerability (CVSS 8.8, Cisco IOS XE Software)
- [CVE-2020-3227](https://cve.now/CVE-2020-3227.md): Cisco IOx for IOS XE Software Privilege Escalation Vulnerability (CVSS 9.8, Cisco IOS XE Software)
- [CVE-2020-3226](https://cve.now/CVE-2020-3226.md): Cisco IOS and IOS XE Software Session Initiation Protocol Denial of Service Vulnerability (CVSS 8.6, Cisco IOS 15.0(2)SG11a)
- [CVE-2020-3225](https://cve.now/CVE-2020-3225.md): Cisco IOS and IOS XE Software Common Industrial Protocol Denial of Service Vulnerabilities (CVSS 8.6, Cisco IOS 12.2(55)SE)
- [CVE-2020-3224](https://cve.now/CVE-2020-3224.md): Cisco IOS XE Software Web UI Command Injection Vulnerability (CVSS 8.8, Cisco IOS XE Software)
- [CVE-2020-3223](https://cve.now/CVE-2020-3223.md): Cisco IOS XE Software Web UI Arbitrary File Read Vulnerability (CVSS 4.5, Cisco IOS XE Software)
- [CVE-2020-3222](https://cve.now/CVE-2020-3222.md): Cisco IOS XE Software Web UI Unauthenticated Proxy Service Vulnerability (CVSS 4.3, Cisco IOS XE Software)
- [CVE-2020-3221](https://cve.now/CVE-2020-3221.md): Cisco IOS XE Software Flexible NetFlow Version 9 Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2020-3220](https://cve.now/CVE-2020-3220.md): Cisco IOS XE Software IPsec VPN Denial of Service Vulnerability (CVSS 6.8, Cisco IOS XE Software)
- [CVE-2020-3219](https://cve.now/CVE-2020-3219.md): Cisco IOS XE Software Web UI Command Injection Vulnerability (CVSS 8.8, Cisco IOS XE Software)
- [CVE-2020-3218](https://cve.now/CVE-2020-3218.md): Cisco IOS XE Software Web UI Remote Code Execution Vulnerability (CVSS 7.2, Cisco IOS XE Software)
- [CVE-2020-3217](https://cve.now/CVE-2020-3217.md): Cisco IOS, IOS XE, IOS XR, and NX-OS Software One Platform Kit Remote Code Execution Vulnerability (CVSS 8.8, Cisco IOS XR Software)
- [CVE-2020-3216](https://cve.now/CVE-2020-3216.md): Cisco IOS XE SD-WAN Software Authentication Bypass Vulnerability (CVSS 6.8, Cisco IOS XE SD-WAN Software)
- [CVE-2020-3215](https://cve.now/CVE-2020-3215.md): Cisco IOS XE Software Privilege Escalation Vulnerability (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2020-3214](https://cve.now/CVE-2020-3214.md): Cisco IOS XE Software Privilege Escalation Vulnerability (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2020-3213](https://cve.now/CVE-2020-3213.md): Cisco IOS XE Software Privilege Escalation Vulnerability (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2020-3212](https://cve.now/CVE-2020-3212.md): Cisco IOS XE Software Web UI Command Injection Vulnerability (CVSS 7.2, Cisco IOS XE Software)
- [CVE-2020-3211](https://cve.now/CVE-2020-3211.md): Cisco IOS XE Software Web UI Command Injection Vulnerability (CVSS 7.2, Cisco IOS XE Software)
- [CVE-2020-3210](https://cve.now/CVE-2020-3210.md): Cisco IOS Software for Cisco Industrial Routers Virtual Device Server CLI Command Injection Vulnerability (CVSS 6.7, Cisco IOS 12.2(60)EZ16)
- [CVE-2020-3209](https://cve.now/CVE-2020-3209.md): Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability (CVSS 6.8, Cisco IOS XE Software 3.2.0SG)
- [CVE-2020-3208](https://cve.now/CVE-2020-3208.md): Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Image Verification Bypass Vulnerability (CVSS 6.7, Cisco IOS 12.2(60)EZ16)
- [CVE-2020-3207](https://cve.now/CVE-2020-3207.md): Cisco IOS XE Software Command Injection Vulnerability (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2020-3206](https://cve.now/CVE-2020-3206.md): Cisco IOS XE Software Catalyst 9800 Series Wireless Controllers Denial of Service Vulnerability (CVSS 4.7, Cisco IOS XE Software)
- [CVE-2020-3205](https://cve.now/CVE-2020-3205.md): Cisco IOS Software for Cisco Industrial Routers Virtual Device Server Inter-VM Channel Command Injection Vulnerability (CVSS 8.8, Cisco IOS 12.2(60)EZ16)
- [CVE-2020-3204](https://cve.now/CVE-2020-3204.md): Cisco IOS and IOS XE Software Tcl Arbitrary Code Execution Vulnerability (CVSS 6.7, Cisco IOS 12.2(53)SE1)
- [CVE-2020-3203](https://cve.now/CVE-2020-3203.md): Cisco IOS XE Software Catalyst 9800 Series Wireless Controllers Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2020-3201](https://cve.now/CVE-2020-3201.md): Cisco IOS and IOS XE Software Tcl Denial of Service Vulnerability (CVSS 6.0, Cisco IOS 12.2(25)S)
- [CVE-2020-3322](https://cve.now/CVE-2020-3322.md): Cisco Webex Network Recording Player and Cisco Webex Player Denial of Service Vulnerability (CVSS 3.3, Cisco Webex Network Recording Player · Cisco Webex Player f…)
- [CVE-2020-3321](https://cve.now/CVE-2020-3321.md): Cisco Webex Network Recording Player and Cisco Webex Player Denial of Service Vulnerability (CVSS 3.3, Cisco Webex Network Recording Player · Cisco Webex Player f…)
- [CVE-2020-3319](https://cve.now/CVE-2020-3319.md): Cisco Webex Network Recording Player and Cisco Webex Player Denial of Service Vulnerability (CVSS 3.3, Cisco Webex Network Recording Player · Cisco Webex Player f…)
- [CVE-2019-20809](https://cve.now/CVE-2019-20809.md): The price oracle in PriceOracle.sol in Compound Finance Compound Price Oracle 1.0 through 2.0 allows a price poster to set an invalid asset (no CVSS)
- [CVE-2020-4035](https://cve.now/CVE-2020-4035.md): DoS or local data modification via malicious record IDs in WatermelonDB (CVSS 5.9, Nozbe WatermelonDB · @nozbe/watermelondb)
- [CVE-2020-13597](https://cve.now/CVE-2020-13597.md): Calico nodes IPv6 traffic redirection from route advertisment (CVSS 6.0, Tigera Calico · github.com/projectcalico/calico)
- [CVE-2020-13782](https://cve.now/CVE-2020-13782.md): D-Link DIR-865L Ax 1.20B01 Beta devices allow Command Injection. (no CVSS)
- [CVE-2020-13783](https://cve.now/CVE-2020-13783.md): D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Storage of Sensitive Information. (no CVSS)
- [CVE-2020-13784](https://cve.now/CVE-2020-13784.md): D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator. (no CVSS)
- [CVE-2020-13785](https://cve.now/CVE-2020-13785.md): D-Link DIR-865L Ax 1.20B01 Beta devices have Inadequate Encryption Strength. (no CVSS)
- [CVE-2020-13786](https://cve.now/CVE-2020-13786.md): D-Link DIR-865L Ax 1.20B01 Beta devices allow CSRF. (no CVSS)
- [CVE-2020-13787](https://cve.now/CVE-2020-13787.md): D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Transmission of Sensitive Information. (no CVSS)
- [CVE-2020-12846](https://cve.now/CVE-2020-12846.md): Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. (no CVSS)
- [CVE-2020-4307](https://cve.now/CVE-2020-4307.md): IBM Security Guardium 11.1 could allow an attacker on the same network to gain access to the Solr dashboard and cause a denial of service at (CVSS 6.5, IBM Security Guardium)
- [CVE-2020-4190](https://cve.now/CVE-2020-4190.md): IBM Security Guardium 10.6, 11.0, and 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its o (CVSS 4.1, IBM Security Guardium)
- [CVE-2020-4187](https://cve.now/CVE-2020-4187.md): IBM Security Guardium 11.1 could disclose sensitive information on the login page that could aid in further attacks against the system. (CVSS 5.3, IBM Security Guardium)
- [CVE-2020-4182](https://cve.now/CVE-2020-4182.md): IBM Security Guardium 11.1 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Security Guardium)
- [CVE-2020-4180](https://cve.now/CVE-2020-4180.md): IBM Security Guardium 11.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. (CVSS 8.8, IBM Security Guardium)
- [CVE-2020-4177](https://cve.now/CVE-2020-4177.md): IBM Security Guardium 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authe (CVSS 6.8, IBM Security Guardium)
- [CVE-2020-13756](https://cve.now/CVE-2020-13756.md): Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelecto (no CVSS, sabberworm/php-css-parser)
- [CVE-2020-10749](https://cve.now/CVE-2020-10749.md): A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernete (CVSS 6.0, Red Hat containernetworking/plugins · github.com/containern…)
- [CVE-2020-10516](https://cve.now/CVE-2020-10516.md): Improper access control in GitHub Enterprise Server leading to privilege escalation of organization member (no CVSS, GitHub Enterprise Server)
- [CVE-2020-13596](https://cve.now/CVE-2020-13596.md): An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. (no CVSS, django)
- [CVE-2020-13254](https://cve.now/CVE-2020-13254.md): An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. (no CVSS, django)
- [CVE-2020-1963](https://cve.now/CVE-2020-1963.md): Apache Ignite uses H2 database to build SQL distributed execution engine. (no CVSS, Apache Ignite · org.apache.ignite:ignite-core)
- [CVE-2020-7116](https://cve.now/CVE-2020-7116.md): The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. (no CVSS, ClearPass Policy Manager)
- [CVE-2020-7117](https://cve.now/CVE-2020-7117.md): The ClearPass Policy Manager WebUI administrative interface has an authenticated command remote execution. (no CVSS, ClearPass Policy Manager)
- [CVE-2020-7115](https://cve.now/CVE-2020-7115.md): The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. (no CVSS, ClearPass Policy Manager)
- [CVE-2020-2200](https://cve.now/CVE-2020-2200.md): Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the \`play\` command on the Jenkins master for a form validatio (no CVSS, Jenkins project Jenkins Play Framework Plugin · org.jenkins…)
- [CVE-2020-2197](https://cve.now/CVE-2020-2197.md): Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Pro (no CVSS, Jenkins Project Inheritance Plugin · hudson.plugins:project…)
- [CVE-2020-2198](https://cve.now/CVE-2020-2198.md): Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting (no CVSS, Jenkins Project Inheritance Plugin · hudson.plugins:project…)
- [CVE-2020-2199](https://cve.now/CVE-2020-2199.md): Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form vali (no CVSS, Jenkins project Jenkins Subversion Partial Release Manager…)
- [CVE-2020-2195](https://cve.now/CVE-2020-2195.md): Jenkins Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips, resulting in a stored cross-site scrip (no CVSS, Jenkins project Jenkins Compact Columns Plugin · org.jenkin…)
- [CVE-2020-2196](https://cve.now/CVE-2020-2196.md): Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative (no CVSS, Jenkins project Jenkins Selenium Plugin · org.jenkins-ci.pl…)
- [CVE-2020-2193](https://cve.now/CVE-2020-2193.md): Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts, resulting in a stored cross-site (no CVSS, Jenkins project Jenkins ECharts API Plugin · io.jenkins.plu…)
- [CVE-2020-2194](https://cve.now/CVE-2020-2194.md): Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored cros (no CVSS, Jenkins project Jenkins ECharts API Plugin · io.jenkins.plu…)
- [CVE-2020-2190](https://cve.now/CVE-2020-2190.md): Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script App (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2020-2191](https://cve.now/CVE-2020-2191.md): Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier does not check permissions on API endpoints that allow adding and remo (no CVSS, Jenkins project Jenkins Self-Organizing Swarm Plug-in Modul…)
- [CVE-2020-2192](https://cve.now/CVE-2020-2192.md): A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to add (no CVSS, Jenkins project Jenkins Self-Organizing Swarm Plug-in Modul…)
- [CVE-2019-20811](https://cve.now/CVE-2019-20811.md): An issue was discovered in the Linux kernel before 5.0.6. (no CVSS)
- [CVE-2019-20812](https://cve.now/CVE-2019-20812.md): An issue was discovered in the Linux kernel before 5.4.7. (no CVSS)
- [CVE-2020-13776](https://cve.now/CVE-2020-13776.md): systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by (CVSS 6.7)
- [CVE-2020-11080](https://cve.now/CVE-2020-11080.md): Denial of service in nghttp2 (CVSS 3.7, nghttp2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-06-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.